[openssl/openssl] 47540a: apps: drop invalid trust setting in check_cert_mig...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 47540a76e38317690bff49bf61ecd0242c453280
      https://github.com/openssl/openssl/commit/47540a76e38317690bff49bf61ecd0242c453280
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M apps/lib/apps.c
    M test/recipes/25-test_x509.t

  Log Message:
  -----------
  apps: drop invalid trust setting in check_cert_might_be_valid()

check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.

The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.

Add a test checking that printing certificate info emits nothing on stderr.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ryan Hooper <[email protected]>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/05b65f-47540a%40github.com.